Security advisories

critical2026-04-03

CVE-2026-35393-goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

patrickhener/goshs · GHSA-jg56-wf8x-qrv5

critical2026-04-03

CVE-2026-35392-goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

patrickhener/goshs · GHSA-g8mv-vp7j-qp64

critical2026-04-03

CVE-2026-35039-fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

nearform/fast-jwt · GHSA-rp9m-7r4c-75qg

low2026-04-03

CVE-2026-35038-Signal K Server: Arbitrary Prototype Read via `from` Field Bypass

signalk/signalk-server · GHSA-qh3j-mrg8-f234

high2026-04-03

CVE-2026-34992-Antrea has Missing Encryption of Sensitive Data

antrea-io/antrea · GHSA-qcmw-8mm4-4p28

critical2026-04-03

CVE-2026-34989-CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-vr2g-rhm5-q4jr

high2026-04-03

CVE-2026-35175-Ajenti has an authorization bypass during custom package installation

ajenti/ajenti · GHSA-73jv-44c3-j5p2

critical2026-04-03

CVE-2026-35171-Kedro has Arbitrary Code Execution via Malicious Logging Configuration

kedro-org/kedro · GHSA-9cqf-439c-j96r

high2026-04-03

CVE-2026-35168-OpenSTAManager: SQL Injection via Aggiornamenti Module

devcode-it/openstamanager · GHSA-2fr7-cc4f-wh98

high2026-04-03

CVE-2026-35167-Kedro: Path Traversal in versioned dataset loading via unsanitized version string

kedro-org/kedro · GHSA-6326-w46w-ppjw

medium2026-04-03

CVE-2026-65912-DOMPurify ADD_ATTR predicate skips URI validation

cure53/dompurify · GHSA-cjmm-f4jc-qw8r

medium2026-04-03

CVE-2026-65913-DOMPurify USE_PROFILES prototype pollution allows event handlers

cure53/dompurify · GHSA-cj63-jhhr-wcxv

medium2026-04-03

CVE-2026-35052-D-Tale: Remote Code Execution through redis/shelf storage

man-group/dtale · GHSA-436g-fhfc-9g5w

high2026-04-03

Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption

auth0/symfony · GHSA-ghc5-95c2-vwcv

high2026-04-03

Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption

auth0/wordpress · GHSA-vfpx-q664-h93m

high2026-04-03

Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption

auth0/laravel-auth0 · GHSA-fmg6-246m-9g2v

high2026-04-03

CVE-2026-32145-wisp has Allocation of Resources Without Limits or Throttling

gleam-wisp/wisp · GHSA-8645-p2v4-73r2

high2026-04-03

CVE-2026-28815-Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length

apple/swift-crypto · GHSA-9m44-rr2w-ppp7

high2026-04-03

CVE-2026-35037-Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

lin-snow/ech0 · GHSA-cqgf-f4x7-g6wc

high2026-04-03

CVE-2026-35036-Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature

lin-snow/ech0 · GHSA-wc4h-2348-jc3p